ABL source code analysis with SonarQube. Gilles QUERRET Riverside Software

Transcription

1 ABL source code analysis with SonarQube Gilles QUERRET Riverside Software

2 SonarQube SonarQube is a platform to manage code quality Free, open source, LGPL, web-based portal Backed by SonarSource Aggregates well-know tools from the Java world Static analysis (PMD, FindBugs, Checkstyle) Duplicate code (Squid, CPD) Code coverage (Cobertura, JaCoCo)

3 SonarQube plugins SonarQube is extensible, providing entry points to manage new languages Both open and closed source plugins (C#, Cobol, ) Extensions are not only for languages, but also for visualization And also rules which are applied on syntax trees (see next slides)

4 SonarQube portal

5 Project portal

6 Project portal

7 Technical debt Term coined by Ward Cunningham in 1992 Technical debt is a metaphor around the time it takes to work with low quality code : If technical debt is high, you ll pay high interest (in terms of time spent) each time you work on the project But you can pay down the principal by refactoring code You ll increase the debt if you add quick and dirty code Do you manager care about code quality? If you want to catch their attention, just let them know they have to pay the bill

8 Drill down into the code

9 What about ABL? Free, open-source, LGPL plugin provided by Riverside Software Plugins (and source code) can be downloaded from : They include parsers, rules management and issue reporting Sample rules also available Additional rules can be bought from Riverside Software Or you can implement them!

10 Lexer and parsers : 'define' 'variable' 'property' 'as' 'character' 'integer' : (' ' '\t' '\n')* -> HIDDEN ID : [a-za-z]* EOS : '.' ' ' ' ' ' ' ' ' define_variable foo as_integer. define_property_bar_as_character. define variable ID foo ID as integer ' ' define property bar as characte r ' ' ' ' ' ' ' '

11 Lexer and parsers defvar: KW_DEFINE KW_VARIABLE ID KW_AS DATATYPE KW_NO_UNDO? (KW_LABEL QUOTED_STRING)? defprop: KW_DEFINE (KW_PUBLIC KW_PROTECTED KW_PRIVATE)? (KW_STATIC KW_ABSTRACT)? KW_OVERRIDE? KW_PROPERTY ID KW_AS (DATATYPE CLASSNAME) ' ' ' ' ' ' ' ' rootnode define variable ID foo as integer ' ' procname: abc.p define ' ' property ' ' ID bar ' ' as ' ' characte r defvarnode name: foo datatype: int no-undo: false label: null defpropnode name: bar datatype: char modifier: public override : false

12 Another small example rootnode procname: eu/rssw/foo.cls classdefinition name: foo package: eu.rssw abstract: false defvarnode defpropnode methodnode methodnode constructornode varname: foo datatype: int no-undo: false label: null varname: bar datatype: char Modifier: public Override : false name: mtd1 modifier: private final : false returns: void params: char, int name: mtd2 modifier: public final : yes returns: eu.rssw.bar params: modifier: public final : yes params: int statementnode doblock type: FIND table: tt1 temp-table: true where: null no-error: true type: while condition: true ifblock type: while expression: not avail tt1 statementnode statementnode type: display stream: expression: tt1.fld1 stream: null type: leave blockname: null

13 Only parsing source code? Parsing can be done : On profiler output (data structures for execution times, code coverage, ) On DF files to know the database structure On XREF files

14 How to install? Download SonarQube 4.2 or 4.3 from Extract in any directory Download OpenEdge plugins from BitBucket to extensions/plugins directory Execute startsonar.sh! SonarQube uses by default an H2 database, which is OK only for tests Please refer to Sonar documentation if you want to use MySQL, MS-SQL or Oracle

15 How to analyze code? Analysis requires build output from PCT Still not using PCT? Go immediatly to and switch your build system to PCT! PCT is another open-source plugin for Ant (also from Riverside Software) Probably the most widely used build tool Perfect in combination with continuous integration

16 How to analyze code? Use the following options in PCTCompile : debuglisting = true listing = true keepxref = true xmlxref = true (PCT 186+) relativepaths = false

17 How to analyze code? Then use Sonar Ant task : <property name="sonar.projectkey" value="eu.rssw.product-db:dev" /> <property name="sonar.projectname" value="product - DB" /> <property name="sonar.projectversion" value="1" /> <property name="sonar.sources" value="schema" /> <property name="sonar.binaries" value="build" /> <sonar:sonar /> Add the following properties to connect to a remote Sonar instance : <property name="sonar.host.url" value=" /> <property name="sonar.jdbc.url" value="jdbc:..." />

18 What to expect? Source code import in the database Debug listing import in the database Basic metrics for source code Number of files, windows, includes, classes Lines of code, comments, blank lines Transaction scopes (from listing files) Code duplication (using tokenized source)

19 What to expect? XREF basic metrics Entry point to report issues and metrics Dump files abstract syntax tree and basic rules

20 Next developments Coming soon : Dependencies between procedures and classes (tangle index) ABL abstract syntax tree and rules Code coverage (from profiler output) Coming later : Prolint output management Progress Developer Studio integration What are you looking for? Please raise your hand

21 Writing your own rules Lint rules will have access either to the source tree, or to a fully built object The source tree know the exact position of your tokens Sonar entry point to report violations Rules have to be written in Java Implementation time is nothing compared to design time!

22 Implementing XREF rules wholeindexexpr = xpath.compile("//reference[@reference-type='search' and Detail='WHOLE-INDEX' and File-num='1']"); NodeList nodelist = (NodeList) wholeindexexpr.evaluate(doc, XPathConstants.NODESET); for (int zz = 0; zz < nodelist.getlength(); zz++) { Element element = (Element) nodelist.item(zz); reportissue(element, "WHOLE-INDEX"); }

23 Lint rule example Verification of variable name length = Priority.INFO, name = "Short variable names", description = Verifies that variable names are at least X = LintList.SONAR_WAY_PROFILE, priority = Priority.MINOR) public class ShortVarNamesRule extends AbstractLintRule { private static final int DEFAULT_MINIMUM_LENGTH = = "minimumlength", defaultvalue = "" + DEFAULT_MINIMUM_LENGTH) public int minimumlength = DEFAULT_MINIMUM_LENGTH; public boolean visit(variabledeclarationstatement decl) { if (decl.getname().length() <= minimumlength) reportissue(getfirstline(decl), decl.getname()); } } return true;

24 Developer Studio integration The Sonar database can be connected from Developer Studio Violations are displayed in the standard editor Lint rules can be executed locally

25 Questions?

26 Reference? Sonar Source : Sonar OE plugin demo site : Riverside Software : Contact : contact@riverside-software.fr